Ministry of Innovation —

Intel’s new vPro: two steps forward for x86… as well as for DRM and P2P?

Intel's launch of vPro 2007 is a major milestone for both x86 virtualization …

TXT: Because your network admin (and Big Content?) needs a safe place inside your system that you can't tamper with

Given the fact that we at Ars, along with the EFF, Slashdot, and the rest of the usual suspects, have beat the "LaGrande" = "Big Content inside your PC" = "DRM nirvana" drum for going on five years now, I find remarkable the lack of hue and cry over the full-scale, production, mass-market rollout of what was once considered by the geekerati (myself included) to be the Worst Idea Ever. Let's take a brief look back at the history of what was finally announced today.

Way back in 2002, when Microsoft announced plans to turn your PC into the Panopticon by placing a fortified virtual room—complete with watchers behind a one-way mirror—in your system, an uproar forced the company to scale back its ambitions. The name of the initiative was Palladium, and the idea was that DRM-encumbered content could run in a "trusted," copy-proof chamber and funnel audio-visual output over trusted links to your monitor and speakers.

The Palladium announcement was followed shortly by Intel's announcement of LaGrande, which would be the hardware part of this "trusted computing" vision. The centerpiece of LaGrande is the Trusted Platform Module, a device whose stated purpose is to safely keep secrets from would-be hackers, viruses, and trojans. But the TPM is also designed to keep secrets from you, the end user, because who knows—you may be a filthy pirate who's out to exercise your fair use rights.

In brief, the TPM is a small ASIC that sits on the motherboard and is useful for a number of different security-related functions. In addition to a small pool of nonvolatile storage that can store keys, it has hardware that implements RSA algorithms for key generation, signatures, and encryption/decryption. It also has a small execution engine that can execute the program code for initializing the device and performing the "measurement taking" functions that are essential to its ability to determine if an execution environment is tampered with.

These TPM facilities can be used to boot the machine in a known, "trusted" state, with a "chain of trust" that extends throughout the entire boot process from the BIOS to the hypervisor or operating system. The TPM can stop the boot process immediately if it determines that the code at any link in the chain (BIOS, hypervisor, OS) is not correct, and it can also signal to a remote system if the machine has booted into a trusted state or not.

Earlier versions of the TPM have been in PCs for some time now, but the module is rarely used both because Windows XP doesn't support it and because the TPM alone is of limited utility. With the launch of the new vPro, however, the full force of LaGrande is now officially upon us. The primary missing piece that has now fallen into place for LaGrande to create fully locked-down regions within your computer is support for I/O virtualization, which finally gives Intel platforms the ability to load, run, and display protected code and content in fully sealed, completely trusted (i.e., "trusted" by your network admin, Sony, Disney, Microsoft, etc., to keep you out of the parts of your system where you don't belong) environments now called Measured Launch Environments (MLEs, formerly "vaults" in LaGrange lingo). VT-d protects the memory space of the sealed-off vault, be it a virtual machine or a process hosted by the OS, from access by unauthorized devices, thereby closing the hole that interrupts and DMA transfers had left in previous vPro implementations.

The higher level of control over memory—specifically the ability to control access at the level of individual physical pages—that VT-d gives TXT provides other security features, like the ability to erase all traces of an MLE from memory once it terminates.

You won't really see much mention of DRM in most vPro coverage, because Intel has (quite appropriately) spent a lot of time and effort over the past few years talking up the TXT + VT-x and VT-d combination as a robust enterprise security and remote management solution. And indeed it is. But as a potential technological enabler of more effective DRM, it's also the ideal companion to Blu-ray and HD DVD, and a godsend to Big Content. Look for it across the rest of Intel's desktop and portable line by the end of 2008 and prepare to kiss fair use goodbye.

Everyone who values security will love it

vPro's potential as an enabling platform for intrusive DRM (again, only one of many possible uses) is disturbing enough that it merits much more attention than it seems to have gotten so far in the tech press, but it shouldn't overshadow the platform's potential benefits. Some nice things are already being done with vPro as a basis, like Symantec's Virtual Security Solution (VSS), formerly known as "Project Hood."

The basic idea behind VSS, which was demonstrated at the vPro launch event, is to launch a lightweight hypervisor that runs the same network intrusion prevention software that you find in Norton AV in a secure virtual machine that can't be reached from Windows. The software sits between the NIC and the OS, and filters inbound and outbound network traffic looking for Trojans, keyloggers, viruses and so on. Ideally, VSS would neutralize such malicious software before it gets into Windows, and if it the Windows partition does become infected the virus can't contaminate the antivirus software because it resides in a secure VM.

New applications like VSS, along with potential of TXT and VT-d for secure remote access and management, will eventually make vPro a must-have in the enterprise and on the consumer desktop. The technology opens up whole new vistas of secure network communication that will excite everyone from e-commerce software vendors to corporate IT departments to foreign governments and militaries... er... waitaminute.

According to a report [PDF] by Endpoint Technologies, both the NSA and the U.S. Army now rely on technology from the Trusted Computing Group, with the Army mandating the same TPM v1.2 modules that form the basis of vPro in all of its computers for network security reasons. This being the case, many folks, myself included, look at "trusted computing" technologies and wonder how the federal government allows them to proceed to market absent the export controls that are typical of strong encryption and so-called "dual-use" technologies that could have potential military applications. But that's a topic for another day.

In the meantime, suffice it to say that vPro 2007 is a big deal for enterprise computing in the near- to medium-term, but whether it's a big deal to online shoppers, foreign militaries, or parties on either side of the DRM vs. "piracy" battles is a question that only time will answer.